Qilin targeting a French critical infrastructure again.

It's time to change how you think about SaaS integrations. The Salesloft attack shows how GitHub → AWS → Drift → Salesforce created an attack highway defenders never saw coming. Jared Atkinson's analysis details the patterns we should look out for. ghst.ly/4ngDQrD

🌈 United for diversity in science 🌈 Researchers from Institut Pasteur joined the 2025 Pride March alongside @institutcurie.bsky.social, Les Cordeliers Research Center, @institutcochin.bsky.social @institutimagine.bsky.social 👩‍🔬 Because diverse labs make better science. #DiversityInScience

North Koreans reportedly host fake Zoom meeting featuring multiple deepfake colleagues. Target’s microphone doesn’t work so the colleagues talk them through installing malicious fix. www.huntress.com/blog/inside-...

La Société Générale revient sur le TT, je crois qu'il y a des bons profils à recruter au CERT :) #JUSTSayin

French scams over SMS now requiring human interactions likely to protect from automated remediation and better identify vulnerable targets

New tricks, same impact posts.specterops.io/update-dumpi...

Mapping Hidden Alliances in Russian-Affiliated Ransomware dti.domaintools.com/mapping-hidd...

cip.gov.ua/ua/news/anal... Ukrainian CERT published a synthesis on 3 years of war time defensive activity that is well worth reading.

New from 404 Media: Flock, the license plate reader company that has cameras all across the U.S., is now building a massive people lookup tool using hacked data. The plan is to "jump from LPR to person." Won't require a warrant. This is according to leak we obtained. www.404media.co/license-plat...

This DTEX report on North Korea's hacking capabilities, along with Viginum's Russian info op report from last week, are probably the best reports of the year so far You MUST read it! PDF: reports.dtexsystems.com/DTEX-Exposin...

We are very excited to announce that Volatility 3 has reached parity with Volatility 2! With this achievement, Volatility 2 is now deprecated. See the full details in our blog post: volatilityfoundation.org/announcing-t...

@drazuread.com Hi, Entra Connect Sync now uses a MSA account for its service by default. Is Get-LSASecrets handling MSA accounts already or just gMSA? AD sync itself is still performed by a MSOL_ account. Thank you! AADInternals 0.9.8 Microsoft Entra Connect Sync 2.4.131.0 pastebin.com/UU4u7YZR

Dear Americans, what have you done…

In our latest article, @croco_byte proposes an implementation of a trick discovered by James Forshaw in his research regarding Kerberos relaying. Discover how to perform pre-authenticated Kerberos relay over HTTP with our Responder and krbrelayx pull requests! www.synacktiv.com/publications...

« Active Directory Hardening Series - Part 4 – Enforcing AES for Kerberos » techcommunity.microsoft.com/blog/coreinf...

« LSA SECRETS: REVISITING SECRETSDUMP » by @synacktiv.com www.synacktiv.com/lsa-secrets-...

An eye-opening blog post on ads-based tracking: « Everyone knows your location: tracking myself down through in-app ads » timsh.org/tracking-mys...

Windows Recycle Bin - The known and the unknown bebinary4n6.blogspot.com/2025/01/wind...

Achievement unlocked, my first blog with SpecterOps 🤗 This post looks at ADFS OAuth2 support, Device Registration, Enterprise PRT, and a brain dump of things that I didn’t want to leave sat on Notion. buff.ly/4j41VQU

Leaked API keys is a huge issue. GitHub detects around 7,000 tokens in public repos **every month**! www.linkedin.com/feed/update/...

Could anyone in this business explain to me how a random app can share PII with 800+ companies?

New #AADInternals version is finally out now: ▪ Moved endpoint related stuff to new module: AADInternals-Endpoints ▪ Added blue team stuff ▪ Added red team stuff See full change log at: aadinternals.com/aadinternals...

This is an IACIS BCFE kinda joke. #Digitalforensics #MobileForensics #DFIR

Surement une des meilleurs conf�rence en cybers�curit� en Europe !

Romania legal system 1 - 0 Russian IO

Russian money laundering networks tied to narco traffickers, ransomware gangs, and Kremlin spies uncovered. Think “McMafia” meets “Narcos” with a dash of “Mr. Robot.” Operation Destabilise is exposing the dark web of cash, crypto, and crime. 🔗 therecord.media/russian-mone... #CyberCrime #Money

Apple AI promoting phishing emails reaching your inbox is 🤌🏻

What started as a long overdue update of my indicators of execution tracker (ioe.1234n6.com), has unsurprisingly spiralled into a whole warren of rabbit holes. Anyone digging into Windows Server 2025 forensic artifacts at the moment? Especially ShimCache and Amcache.